Secure Boot State Unsupported: How to Fix

Q: Does converting MBR to GPT delete my files?

No. mbr2gpt, the tool built into Windows, converts a disk from MBR to GPT in place and is designed not to modify or delete data on it. Back up first anyway: any change to a boot drive's partition table carries some risk, and a backup takes minutes.

Secure Boot State: Unsupported usually doesn’t mean your PC lacks Secure Boot. It means Windows can’t see it, almost always because the drive still uses the old MBR partition style. Check BIOS Mode in msinfo32: if it reads Legacy, this is fixable without reinstalling.

You’ll have spotted the message in System Information while checking whether the PC can run Windows 11. There are three different situations behind that one word, and only one of them is bad news.

What the three values actually mean

Press Win + R, type msinfo32, press Enter. Look at two rows:

BIOS Mode	Secure Boot State	What it means
UEFI	On	Everything is fine
UEFI	Off	Hardware supports it, it’s just disabled in firmware
Legacy	Unsupported	Your drive uses the old MBR partition style — fixable
UEFI	Unsupported	Firmware genuinely lacks Secure Boot (older or unusual boards)

The row that matters is BIOS Mode. If it says Legacy, your hardware is almost certainly fine — Windows was just installed the old way. That’s the common case, and it’s fixable without reinstalling anything.

Why this matters

Windows 11 requires Secure Boot and TPM 2.0. If Secure Boot shows as Unsupported, the upgrade will be blocked and PC Health Check will fail you. Microsoft’s own documentation notes that TPM 2.0 requires UEFI firmware, so a PC still booting in Legacy mode tends to fall short on both requirements at once. Some anti-cheat systems in newer games also require it now.

Case 1: BIOS Mode says Legacy — convert to UEFI

Your disk uses MBR partitioning, which can’t do UEFI boot, which means Secure Boot is unavailable. Windows includes mbr2gpt, documented by Microsoft as converting a disk from MBR to GPT without modifying or deleting data on it.

Back up first. This works reliably, but you’re changing the partition table on your boot drive. Don’t skip this.

Step 1 — check the disk can be converted

Open Command Prompt as administrator and run:

mbr2gpt /validate /allowFullOS

If you get Validation completed successfully, continue. If it fails, note the error: the most common one is that the disk has more than three primary partitions, or there’s not enough free space at the start of the disk for the EFI partition.

Step 2 — find your disk number

diskpart
list disk
exit

Note the number of the disk Windows is on, usually 0.

Step 3 — convert

mbr2gpt /convert /disk:0 /allowFullOS

Replace 0 with your disk number. It takes under a minute.

Step 4 — switch the firmware to UEFI

This part is essential. If you convert the disk but leave the firmware in Legacy/CSM mode, the PC won’t boot. You’ll be working in the same firmware menus that come up when you fix slow startup on Windows, so some of the settings will already look familiar.

Restart and enter your BIOS/UEFI (tap Del, F2, F10 or F12 — your splash screen says which)
Find Boot Mode, CSM, or Launch CSM, usually under Boot or Advanced
Set boot mode to UEFI and disable CSM (Compatibility Support Module)
Save and exit

Step 5 — enable Secure Boot

Back in the firmware:

Look under Boot, Security, or Authentication for Secure Boot
Set Secure Boot Mode or OS Type to Standard or Windows UEFI mode
Set Secure Boot to Enabled
If it’s greyed out, see the section below
Save and exit

Check msinfo32 again. BIOS Mode should read UEFI and Secure Boot State should read On. With that in place the upgrade can proceed, and the Windows 11 Installation Assistant will no longer fail you on Secure Boot.

Case 2: BIOS Mode says UEFI, Secure Boot is Off

Simpler: the hardware is ready, the setting is just off. Go straight to Step 5 above.

When Secure Boot is greyed out

This trips up a lot of people. Two things usually cause it:

No administrator password set. Many firmwares refuse to let you change security settings until a supervisor/administrator password exists. Find Set Supervisor Password or Administrator Password under the Security tab, set one, then Secure Boot becomes editable.

Write that password down. Some boards make it genuinely difficult to clear.

Secure Boot keys aren’t loaded. Look for Restore Factory Keys, Install Default Secure Boot Keys, or Reset to Setup Mode and run it. That reloads the signature databases Secure Boot checks at startup, Microsoft’s certificates among them, after which Secure Boot can be enabled.

Also check that CSM is fully disabled — many boards keep Secure Boot locked while any compatibility module is active.

If the PC won’t boot after enabling Secure Boot

Go back into the firmware and turn Secure Boot off. You’re back where you started, nothing is broken. Then check:

Is CSM disabled?
Was the disk actually converted to GPT? Run msinfo32 and confirm BIOS Mode says UEFI.
Do you dual-boot Linux? Some distributions need their own key enrolled, or work only with Secure Boot off.
Do you have an old graphics card? Cards from before roughly 2013 have non-UEFI video BIOS and can produce a black screen with CSM disabled.

Case 3: genuinely unsupported firmware

If BIOS Mode already says UEFI and there’s no Secure Boot option anywhere in the firmware, check for a BIOS update from your motherboard or PC manufacturer first. Some boards from around 2012–2015 gained Secure Boot in a later firmware release.

If there’s no update and no option, the board doesn’t support it. Windows 10 runs fine; Windows 11 won’t officially install. There are unofficial ways around the requirement, but they leave you on an unsupported configuration that can break at any update, so it isn’t something to rely on for a machine you depend on.

Check TPM at the same time

Windows 11 needs both Secure Boot and TPM 2.0, so you may as well check both while you’re in there. Microsoft’s guide to enabling TPM 2.0 also lists where the setting sits on Asus, Dell, HP, Lenovo and Surface machines.

Press Win + R, type tpm.msc, press Enter.

“The TPM is ready for use” with Specification Version 2.0 — you’re set
“Compatible TPM cannot be found” — it’s probably disabled in firmware

In the firmware, look for:

Intel — PTT (Platform Trust Technology), usually under Advanced → PCH-FW Configuration
AMD — fTPM or AMD CPU fTPM, usually under Advanced → AMD fTPM configuration

Set it to Enabled. It’s firmware-based, so you don’t need a physical TPM chip on most machines built after about 2016.

Quick reference

Symptom	Fix
BIOS Mode: Legacy	Run `mbr2gpt`, then switch firmware to UEFI
BIOS Mode: UEFI, Secure Boot Off	Enable it in firmware
Secure Boot option greyed out	Set a supervisor password, or restore factory keys
No Secure Boot option at all	Update the BIOS; if none, hardware doesn’t support it
PC won’t boot after enabling	Disable it again, verify CSM is off and disk is GPT
Secure Boot on but Windows 11 still blocked	Check TPM 2.0 in `tpm.msc`

Common questions

Does converting MBR to GPT delete my files?

No. mbr2gpt, the tool built into Windows, converts a disk from MBR to GPT in place and is designed not to modify or delete data on it. Back up first anyway: any change to a boot drive’s partition table carries some risk, and a backup takes minutes.

Do I need to reinstall Windows to get Secure Boot?

No. You don’t need to reinstall Windows to enable Secure Boot: mbr2gpt has shipped with Windows since version 1703, so an MBR disk can be converted to GPT in place. After that, switch the firmware to UEFI and turn Secure Boot on.

Is Secure Boot worth enabling if I’m staying on Windows 10?

Secure Boot is worth enabling on Windows 10, though it isn’t urgent. The firmware checks the signature of every piece of boot software before Windows loads, which blocks a class of bootkit malware from ever starting. It’s a real security gain, not just a Windows 11 requirement.

Will enabling Secure Boot break my dual-boot Linux setup?

Usually not. Ubuntu, Fedora and other major distributions ship signed bootloaders and work with Secure Boot enabled. Smaller distributions, custom kernels and out-of-tree drivers may need their key enrolled through MOK (Machine Owner Key) at boot, or they’ll only start with Secure Boot switched off.

My PC is quite new and still shows Legacy.

A new PC showing Legacy BIOS Mode usually means Windows was installed from a USB stick that booted in Legacy mode, so setup created an MBR disk on hardware that fully supports UEFI. The hardware is fine. Run mbr2gpt to convert the disk, then switch the firmware to UEFI.

Do these in order: convert the disk first, then change the firmware. If you enable UEFI mode in firmware while the disk is still MBR, the machine won’t boot and you’ll have to go back into the BIOS to undo it.